[Coverage Report] Test Coverage Report — 2026-10-10

[github-actions[bot]]

📊 Test Coverage Report — 2026-10-10

Overall Coverage

Metric	Coverage
Statements	91.61%
Branches	85.33%
Functions	90.32%
Lines	93.09%

🛡️ Security-Critical Path Status

🟢 OK src/docker-manager.ts: stmts=100% branch=100% funcs=100%
🟢 OK src/host-iptables.ts: stmts=100% branch=100% funcs=100%
🟢 OK src/squid-config.ts: stmts=100% branch=100% funcs=100%
🟢 OK src/cli.ts: stmts=85.71% branch=50% funcs=100%
🟢 OK src/domain-patterns.ts: stmts=100% branch=89.47% funcs=100%

📋 Coverage Table

File	Stmts	Branch	Funcs	Lines	Status
src/nvx/cleanup-registry.ts	42.8%	32.11%	54.23%	41.32%	❌
src/bounded-execution/finite-cardinality.ts	46.03%	35.29%	66.66%	52.83%	❌
src/microvm/network-reservation.ts	51.5%	54.86%	58.33%	53.27%	⚠️
src/bounded-execution/finite-disclosure.ts	51.78%	11.42%	37.5%	54.16%	⚠️
src/bounded-execution/finite-schema.ts	57.07%	56.88%	73.91%	59.58%	⚠️
src/nvx/cleanup-store.ts	65.59%	55.1%	71.42%	70.58%	⚠️
src/bounded-execution/strict-json-parser.ts	67.53%	65.04%	100%	83.49%	⚠️
src/nvx/preflight.ts	70.83%	73.33%	54.54%	72.03%	⚠️
src/enclave/runtime-preflight.ts	71.42%	46.51%	100%	70%	⚠️
src/microvm/rootfs.ts	71.69%	54.54%	100%	72%	⚠️
src/test-helpers/config-writer-dependency-mocks.test-utils.ts	73.91%	100%	80%	66.66%	⚠️
src/cloud-hypervisor/cleanup-vmm-identity.ts	75.86%	70.76%	100%	79.24%	⚠️
src/nvx/one-shot-adapter.ts	79.11%	66.66%	89.65%	81.74%	⚠️
src/cloud-hypervisor/virtiofsd.ts	79.38%	66.66%	64.28%	80.76%	⚠️
src/enclave/github-gateway.ts	79.8%	74.13%	83.87%	82.56%	⚠️
src/routing/bootstrap.ts	79.8%	68.27%	83.33%	85.26%	⚠️
src/nvx/runtime-lifecycle.ts	79.88%	63.59%	92.98%	84.56%	⚠️
src/cli.ts	85.71%	50%	100%	85.71%	✅
src/microvm/vsock-client.ts	93.07%	90.6%	91.3%	97.07%	✅
src/enclave/delegation-control-client.ts	94.92%	94.73%	92%	94.53%	✅
TOTAL	91.61%	85.33%	90.32%	93.09%

🔧 Function Audit

=== host-iptables.ts ===
=== squid-config.ts ===
=== domain-patterns.ts branch count ===
if-branches: 2
switch-branches: 1
Test files: 391 / Source files: 383

📅 Recent Source Changes (last 7 days)

Newly added exported functions in the last 7 days:

resolveRunSandboxBackend, validateRunSandboxBackend, captureEnclaveStartupDiagnostics,
planNvxLiveMounts, appendMountArguments, createStoragePropagationEvidence,
observeStorageMount, observeCoveringPropagation, assertPrivateStorageObservation,
assertPrivateStorageMount

🔎 Notable Findings

• Security-critical files are fully covered on statements and functions. host-iptables.ts, squid-config.ts, and docker-manager.ts are at 100% statements, branches, and functions.
• src/domain-patterns.ts has a branch gap. Branch coverage is 89.47%, with 2 uncovered if branches and 1 uncovered switch branch.
• src/cli.ts has the weakest security-critical branch coverage. Statements are 85.71% and branches are 50%.
• New NVX/storage-propagation code is largely untested. src/nvx/cleanup-registry.ts (42.8% stmts) and src/bounded-execution/finite-cardinality.ts (46.03% stmts) are the lowest-covered files, flagged CRITICAL in the gaps brief.

🎯 Recommendations

High

1. Add tests for src/nvx/cleanup-registry.ts (42.8% stmts, 32.11% branch) and src/bounded-execution/finite-cardinality.ts (46.03% stmts, 35.29% branch). Cover cleanup and cardinality-limit branches first.
2. Close the src/domain-patterns.ts branch gap (89.47%). Add cases for the uncovered if and switch branches, since this file validates domain input for the allowlist.

Medium
3. Raise branch coverage in src/cli.ts (50%). Focus on option-parsing and error-path branches.
4. Add tests for the storage-propagation helpers (createStoragePropagationEvidence, observeStorageMount, assertPrivateStorageMount) and for resolveRunSandboxBackend / validateRunSandboxBackend, added in the last 7 days.

Low
5. Improve src/bounded-execution/finite-disclosure.ts (11.42% branch), src/bounded-execution/finite-schema.ts (56.88% branch), and src/microvm/network-reservation.ts (54.86% branch).

---

Generated by test-coverage-reporter workflow. Trigger: schedule

Generated by Test Coverage Reporter · copilot · sum00 · 0.968 AIC · ⊞ 7.2K · ◷

• expires on Oct 17, 2026, 4:50 AM UTC